US20060167598A1

US20060167598A1 - Avionic system and ground station for aircraft out of route management and alarm communications

Info

Publication number: US20060167598A1
Application number: US10/520,613
Authority: US
Inventors: Maurizio Pennarola
Original assignee: Marconi Selenia Communications SpA
Current assignee: Selex Elsag Datamat SpA
Priority date: 2002-07-10
Filing date: 2003-07-10
Publication date: 2006-07-27
Also published as: WO2004008415A1; AU2003250032A1; CN1666239A; RU2005103593A; BR0312559A; ITRM20020371A1; ATE325408T1; DE60305041T2; DE60305041D1; EP1527432A1; ITRM20020371A0; RU2318243C2; CA2491831A1; ES2264006T3; EP1527432B1

Abstract

An avionic system and ground station for aircraft out of route management and alarm communications composed of an avionic device, which is fitted onboard the aircraft, with a memory unit for storing the flight paths data, runways, orography, and obstacles; processors to compute the stored or received data, available from sensors monitoring the onboard situation. Processors will compute commands to be sent to the aircraft's autopilot to temporarily take over the aircraft control and return it to pre-set flight levels or spatial positions; communication devices suitable for transmitting the real time onboard situation to ground control stations when potentially dangerous events occur.

Description

TECHNICAL FIELD

This invention relates to an avionic system and ground station for aircraft out of route management and alarm communications. More particularly, it relates to a system for handling events in case of deviations from the authorized flight paths and from the pre-set altitude or flight level or spatial limits, and automatically transmitting the onboard situation in real time to ground control stations when potentially dangerous events occur.

BACKGROUND ART

Out of mute aircraft caused particularly serious events, including loss of life. This situation has been traditionally handled by equipping the plane with flight instruments able to display the real time situation to the pilots and to transmit to ground the security codes entered by the pilots. Given the inadequacy of said means to handle complex situations, the above mentioned avionic system and ground station allows civil aircraft to temporarily operate independently from the pilot, in order to protect the civilian population. This system allows the aircraft to automatically react to deviations from the authorized flight paths and from the pre-set altitude or flight level or spatial limits, and is able to convey the exact onboard situation in real time to ground control stations when potentially dangerous events occur such as pilot errors, particular atmospheric conditions, failures, chaos, hijackings, and so forth.

SUMMARY OF THE INVENTION

It is the main object of this invention to provide an avionic system and ground station for aircraft out of mute management and alarm communications that Is able to actively control the aircraft route and convey the onboard situation to ground stations in the event of an alarm, effectively increasing aircraft safety and security for passengers population and residential areas benefit.
It is another object of the invention to provide a system that can be easily installed and used on aeroplanes, in compliance with commercial aviation regulations.
These objects, and others that shall become readily apparent from the following description, are met according to a first aspect of the invention, a control function for managing out of route aircraft (collision avoidance) with the features of claim 1 and, in accordance with another aspect of the invention by means of a method for aircraft out of route management according to claim 9.
The above functions are performed by an avionic device (which will be certified for flight) and are suitable for improving the day-to-day flight safety, increasing the passengers and the civilian population safety. Implementing the solution in accordance with the invention following targets has significant advantages: maximum possible safety for the passengers; real time alarms detection and appropriate reactions; appropriate emergencies handling; automatic events detection independently from human intervention; reliable processing of alarm signals and secure communication with ground control stations; standardized interfaces to allow installation on the greatest possible number of aeroplanes.
The above functions and targets are achieved by means of a system consisting of different elements: an avionic device, which carries out “collision avoidance” and “alarm” functions; suitable sensors and on board transmitters; a ground control station composed by computing systems. The device is installed in a specific protected housing of the aircraft; it is not accessible and cannot be disabled from the cockpit.
The first function, “collision avoidance”, is performed in the device and intervenes temporarily and independently of the pilot as soon as the aircraft deviates from the pre-set flight path, regardless of the causes. This could occur, for example, if the aircraft flyes in not allowed directions or descends below the altitudes/flight levels authorized by the air-traffic control regulations. The second function, “alarm”, is also performed in the device and enables the above mentioned ground control stations to receive all the necessary information from the aircraft (for example, routes data and images) for carrying out appropriate evaluations when potentially dangerous events occur.
Further advantages of the invention shall be readily apparent from the more detailed description of a particular embodiment of the invention, given as a non-limiting example with reference to the following accompanying drawings:
FIGS. 1 and 2 show a schematic diagram of an aircraft that uses the system of the invention
FIG. 3 shows a schematic diagram of a runway, which shows approaching aeroplane limits and gives an environment indication related to the system of the invention

DESCRIPTION OF A PREFERRED EMBODIMENT

FIG. 1 shows an aircraft that uses the system of the invention. The authorized flight path is the upper one; the permissible limits for said flight path are also shown—if the aircraft descends below these limits, the system automatically intervenes temporarily by making the aircraft climb to the above said altitude limit and informing the ground control stations of the alarm condition (FIG. 2).
FIG. 3 shows a schematic diagram of an airport runway. The virtual cones set the spatial limits for containing the flying aircraft—if the aircraft descends below these limits, the system automatically temporarily intervenes making the aircraft climb to a defined limit altitude and informing the ground control stations of the alarm condition. To maximize safety the system properly considers the land orography, buildings, nearby aircraft, the missing approach volumes and the authorized circling areas.
The system, in accordance with the invention, is composed by an avionic device installed onboard commercial and general aviation aircraft, several sensors and transmitters installed in appropriate points of the aircraft, and connections between said sensors and the avionic device. The system exchanges information with ground control stations specifically designed to handle the data transmitted from the aircraft and to perform secure communication with the avionic device.
The avionic device comprises CPU (Central Processor Unit) suitable for handling all the data at the required processing speed, specific software, electronic components; it has memory devices suitable for storing the world flight paths data and relevant limits, the world's airports positions and relevant limits, any other required data; input and output interfaces suitable for exchanging the required information and data between the aircraft, other nearby aircrafts and the ground control stations.
The “collision avoidance” function, which is one of the functions carried out by the avionic device, is not only used to avoid collisions when the aircraft is flying, but also during landing and take-off. When controlling the aircraft route, the unit operates based on the global authorized minimum cruising altitudes and flight levels, the so-called “limits”, covering every area of the globe, always in compliance with all the civil aviation regulations, including the ICAO ones. As a non limiting example, when the aircraft is out of route or descends below the said limits (see FIG. 1), the unit automatically temporarily intervenes through appropriate connections with the unit itself, the autopilot and the navigation system.
During take-off and landing, the unit operates by creating virtual cones that delimit air space and considering the land orography, the flying and ground obstacles, and all other data of interest (as shown schematically in FIG. 3); these data for every area of the globe are stored in the storage unit of the system as necessary. The “collision avoidance” function is carried out through two states. In the first state, the so-called “monitoring state”, the unit constantly compares the position of the aircraft with the pre-set and stored authorized limits. The unit continuously receive the data through its interfacing with the navigation system of the aircraft and its sensors. The limits depend on the flight areas, the applicable regulations, the man-built constructions, obstacles and many other factors. For example, the stored data includes the coordinates of all the world's airports and all the landing and take-off procedures established in compliance with the ICAO regulations. All the necessary information is kept up to date in real time, so that any changes to the above parameters are considered when competent authorities or aeronautical bodies change it, and this is accomplished through appropriate automatic updating procedures performed connecting the unit to ground control stations through data links (links described in the alarm function).
In the second state, the so-called “control state”, when the aircraft deviates from the authorized limits the unit intervenes automatically on the autopilot, through the aforementioned interfaces, to take the aircraft to its spatial limit.
The preferred version of the aircraft out of route management system is as follows: in the monitoring state, it allows all the aircraft flying at altitudes or flight levels higher than the pre-set limit (established by the ICAO regulations for the different flight paths) to stay under the direct pilot control, also allowing flight path changes above the limit altitude or flight level (alarms will be generated only in case of big flight path changes). The transition to the control state only occurs if the aircraft leaves its route to fly in unauthorized directions or descend below the preset limit. In this case, the unit temporarily takes control of the aircraft, through the collision avoidance function, to make the aircraft climb to the pre-set limit. Once the safety limits have been restored, the system gives the control back to the pilot.
The preferred version of the collision avoidance function during landing and take-off is as follows: for each airport two virtual cones (one in the landing direction and one in the take-off direction) are designed via software, in compliance with the instrument approach procedure, the missed approach procedure and virtual circling areas for the concerned runways. When the aircraft is involved in landing or take-off phases, the unit may also command the autopilot and temporarily take the control of the aircraft to place it in a predetermined position at a safety height. For example, this can occur in the following cases:
If during the approach procedure in the landing cone the aircraft suddenly flies below the cone limits (alarms will be generated if it flies out the cone above the limits);
If the aircraft flies at a speed considered incompatible with the landing and missed approach procedures;
If during climbing or after flying over the runway, the aircraft suddenly flies below the cone limits (alarms will be generated if it flyes out the cone above the limits).
The collision avoidance function is constantly able to compute the optimal climbing flight path and speed to avoid crashing to a ground or air obstacle. It accomplishes this by using its and other aircraft speed and position, the protection areas, the orography of the land, the artificial obstacles placed near airports, and any other required information available on board through the a.m. interfaces.
Additionally other interfaces are foreseen in unit; interfaces with sensors to receive row signals in order to calculate automatically an independent present position, interfaces with the navigation system to get the present position signals already computed by other equipment in order to check the accuracy of the data.
The collision avoidance system may be optionally doubled to make the system even more reliable.
The second main function carried out by the avionic device, the so-called “alarm function”, is to allow communication between the aircraft and ground control stations or other aircraft. The “alarm function” function is also carried out through two states.
The first, the so-called “monitoring state”, consists in collecting information on the aircraft onboard situation and storing it in the memory unit. This information is not automatically transmitted to the ground control stations. In the second state, the so-called “alarm state”, which is activated in cases of alarm, the unit transmits the information generated onboard the aircraft to the ground control stations for appropriate evaluation.
To carry out the alarm function, in addition to the avionic unit described above, it is required to install on board additional devices, such as miniature surveillance video cameras, miniature transmitters that can be worn by the flight crew, switches, cockpit locking systems, specific interfaces, and an appropriate communications system. Suitable ground control stations complete the system. Other devices may also be connected when required by regulations or airline specifications.
A preferred description of the process carried out by the avionic unit to fulfil the alarm function is given below. In the monitoring state, the avionic unit has a “surveillance” role and constantly communicates with the video cameras and sensors onboard the aircraft. It records the images and the required information at pre-determined time intervals, and stores the information and data for a pre-determined amount of time. In this state, through interfaces with the collision avoidance function, the unit constantly compares the position of the aircraft with the expected route in the flight plan; furthermore, the unit continuously automatically checks its functions. The system enters the pre-alarm state if a hijacking or terrorist act is detected by the sensors or the flight crew, if there is a significant deviation from the flight plan or if the cones areas are not respected. In this state, a validation request is sent to the nearest ground control station. If this is not validated within the predetermined time interval by the ground control station, the unit will automatically pass from the monitoring state to the alarm state. It goes directly in alarm state if the aircraft flies below the a.m. flight limits.
In the alarm state, the unit constantly transmits the aircraft navigation data and other data (for example, images) to ground control stations, and receives messages to the flight crew and passengers. Both in the monitoring and in the alarm state, the unit works independently of the pilot and, in the event of attested terrorist events, it automatically communicates any necessary data to the ground control stations. Appropriate measures will be implemented so that, even in the case of mechanical damage to the onboard instruments or wiring, the unit is not affected.
The unit have its interfaces with the onboard systems and with the aircraft communications system in order to communicate all the necessary data with the ground control stations.
The system comprises a number of miniature surveillance video cameras, which are installed in appropriate positions depending on the size of the aircraft and are wired to the alarm unit. During the monitoring state, the video cameras automatically send a signal if they have been disabled, damaged, or covered. The video cameras transmit the images constantly both to the cockpit and to the unit.
The system comprises several sensors appropriately connected to the alarm unit installed in the aeroplane in appropriate positions depending on the size of the aircraft. Preferred sensors are “radio controlled” crew wearable miniature transmitters that can be operated with switches. These are “radio controlled” heart rate monitors for the pilots, switches on board usable by the flight crew. The flight crew may manually activate the sensors, sending different impulses to the avionic unit in the event of hijacking or a terrorist act; these transmitters are equipped with switches and have specific protective mechanisms to protect against false alarms. Furthermore, switches are located in places that may be accessed by the passengers as well. Optionally, in case of alarm the unit could automatically lock access to the cockpit.
The system is completed with suitable ground control stations. Preferably, these do not receive information during the monitoring state of the unit. In the pre-alarm state or when the alarm state is confirmed, the ground control stations receive, from the concerned aircraft flying in their range, both the information registered before the alarm event and real time information from the aircraft. The ground control stations will perform the following preferred procedure: provide the received information to the competent authorities; continuously check the correctness of the flight parameters of the aeroplanes under their control when in the pre-alarm state and alarm state; constantly check the aeroplane onboard situation during hijacking and promptly relay the needed information. An adequate number of ground control stations will be located for the proper management of the system in the locations deemed necessary by the national authorities. The stations will include at least the following systems: adequately powerful computers with specifications suitable for the functions to be performed, a receiver-transmitter radio system, an encryption and coding system, an audio-visual-data communications system. The onboard/ground/onboard transmission of the information will be performed preferably through a data link connection managing audio, data radar and video signals and featuring an encryption and coding system capable to provide high resistance to jamming. Transmitted data will be sent with a suitable data format on appropriate transmission frequencies and with adequate waveforms. Spread spectrum techniques (Frequency Hopping or Direct Sequency) will be also considered to improve the quality, security, and reliability of the transmission and to avoid interference with other radio transmissions.
To avoid possible collisions with other aeroplanes in the collision avoidance function (or in the alarm state) when the autopilot is bringing the aircraft to the pre-set spatial position at a certain altitude or flight level, the system will be provided with the nearby aircraft position. For example, to accomplish this, the unit may receive information coming from General Aviation systems such as the Automatic Dependent Surveillance (ADS) system, which is able to transmit the aircraft position via radio link, or can receive data detected by ground radars, which will transmit them to the concerned aircraft in the most appropriate way (exemple, through the a.m. ground control station).
To increase connectivity and minimize the number of ground control stations, the system may also operate through a specific satellite Wide Band Data Link connection. This will allow the aircraft to be monitored when flying over open oceans and improve the transmission of images in terms of speed and size, which could be very slow if a radio band is used.
Optionally, appropriate measures may be implemented in the unit to electronically scan the on board images (for example, to automatically detect the presence of firearms). Optionally, narcotic or poisonous gas detectors may be installed on board.
The system also provides a function for handling the emergencies. This considers both the possibility that the system may be disabled under the threat of arms and the need for the pilot to immediately intervene in the critical phases of a real emergency. To achieve the first objective the system always works automatically, and cannot be disabled by the pilot. In case of alarm the system sends messages, incuding diabling codes. The use of secure radio bands guarantees a secure connection with the ground control stations and makes it possible for the aircraft to send automatically, if the alarm event is triggered, standard messages that inform the competent authorities of the onboard situation and to receive any disabling signals from ground. For this reason it is possible to confirm the disabling of the entire system from a ground control station or from another aircraft after checking the received messages (example images). This covers the risk that the system may be shut down by accident, by “expert” telecommunications terrorists, or under threat of weapons.
To achieve the second objective, necessary to automatically disable the system through the avionic unit. A list of possible of technical-operational-structural serious emergencies to be stored in the unit (for example, engine failure) must be prepared. Real signals need to be received by the unit through specific interfaces with the onboard systems. When these emergencies occur, a specific software will immediately react, giving complete control to the pilot. The unit will then start communicating to the ground station, sending the stored and real time data and asking for confirmation of the disabling code. In case of confirmation the unit automatically disables.
Thanks to the above characteristics and functions, the system of the invention provides real time information on the situation onboard the aeroplane and allows the aircraft to fly below the limit altitude or flight level only for taking off or landing, preventing the aircraft from descending to any point of the globe unless there is a real emergency on board. Thus, the system is able to manage an aircraft out of route, increasing the flight safety, providing to ground, through secure communication, the onboard situation in real time. In addition, the system increases the day-to-day flight safety since it provides an automatic service that prevents the aircraft from descending, even in the event of an error, below the minimum height established by the regulations, avoiding possible accidents due to human and or environmental factors.
The system, thanks to the interfaces with the onboard systems, can optionally take the aircraft to an autonomous landing, depending on the aircraft and airport equpment configuration.

Claims

1-11. (canceled)

12. An avionic system for aircraft out of route management and alarm communications comprising:

at least an avionic unit, located onboard an aircraft, provided with:

a memory unit for storing predefined information,

electronic processing means for processing the received information and comparing it in real time with predefined values,

interfaces for receiving information from onboard systems and sending commands to an aircraft's autopilot to take over the control of the aircraft and return it to predefined flight levels or spatial positions,

suitable sensors for obtaining data on the aircraft onboard situation,

communication system for transmitting the onboard situation in real time to a ground control station and receive from the ground control station, or from another aircraft, appropriate instructions when predetermined events occur,

wherein the avionic unit is able to perform a collision avoidance function, to avoid collisions during aircraft flight, landing and take-off, wherein the collision avoidance function defines a monitoring stage, during which the avionic unit constantly compares the position of the aircraft with predefined and stored authorized limits, and a control stage, during which, if the aircraft deviates from the authorized limits, the avionic system intervenes automatically on the autopilot, through said interfaces, to bring back the aircraft within its spatial limit, and

wherein the avionic unit is able to perform an alarm function, wherein the alarm function defines a first, monitoring stage, during which information on the situation onboard the aircraft is stored in the memory unit and is not automatically transmitted to the ground control stations, and a second alarm stage which is activated in cases of alarm, during which the information generated onboard the aircraft by the avionic unit is transmitted to the ground control stations for appropriate evaluation.

13. An avionic system according to claim 12, wherein said information relates to flight paths, world's runways, orography of the land, obstacles and the predefined values comprise flight paths and altitudes or flight levels.

14. An avionic system according to claim 13, wherein where the aircraft sensors comprise surveillance video cameras and miniature transmitters, wearable by the flight crew, in order to obtain information for the avionic unit.

15. An avionic system according to claim 14, wherein the video cameras comprise means for establishing whether they have been disabled, damaged, or are malfunctioning.

16. An avionic system according to claim 15, wherein the sensors comprise heart rate monitors for the pilots to be connected to the avionic unit.

17. An avionic system as claimed in claim 16, comprising means for encrypting and coding the signals exchanged between the aircraft and the ground control station not interfering with the radio band communications.

18. An avionic system according to claim 15 comprising switches located in specific points of the aircraft available to crew and passengers to obtain information for the avionic unit, and a cockpit automatic locking system.

19. An avionic system as claimed in claim 18, comprising means for encrypting and coding the signals exchanged between the aircraft and the ground control station not interfering with the radio band communications.

20. An avionic system according to claim 15 comprising, in the event of an emergency, means suitable for externally and/or automatically disabling the collision avoidance system in accordance to predefined rules.

21. An avionic system as claimed in claim 20, comprising means for encrypting and coding the signals exchanged between the aircraft and the ground control station not interfering with the radio band communications.

22. A ground control station suitable for interfacing with an avionic system comprising at least an avionic device, placed onboard an aircraft, with a memory unit, electronic processing means, interfaces, sensors, communication system, wherein the avionic device is able to perform a collision avoidance function and an alarm function, the ground control station comprising:

at least a computer for processing data received from said avionic system;

a transmission-reception radio system;

an encrypting and/or coding system; and

an audio-visual communications system; and

wherein the ground control station comprises means for carrying out a collision avoidance function, to avoid collisions during aircraft flight, landing and take-off, the collision avoidance function defining a monitoring stage, during which the unit constantly compares the position of the aircraft with predefined and stored authorized limits and a control stage, during which if the aircraft deviates from the authorized limits the unit intervenes automatically on the autopilot, through said interfaces, to take back the aircraft to its spatial limit, and

wherein the ground control station comprises alarm means for carrying out an alarm function, wherein the alarm function defines a monitoring stage, during which information on the situation onboard the aircraft is stored in the memory unit and are not automatically transmitted to the ground control stations, and an alarm stage which is activated in cases of alarm, during which information generated onboard the aircraft by the avionic unit are transmitted the to the ground control stations for appropriate evaluation.

23. A method for aircraft out of route management wherein there are provided an avionic system comprising at least an avionic unit, fitted onboard an aircraft, with a memory unit, electronic processing means, interfaces, sensors, communication system, wherein the avionic unit is able to perform a collision avoidance function and an alarm function, and a ground station comprising at least a computer, a transmission-reception radio system, an encrypting and/or coding system, an audio-visual communications system and means for carrying out a collision avoidance and an alarm function, the method comprising the following steps:

defining first data for a collision avoidance function and loading said data into the avionic unit;

defining second data for an alarm function and loading said data into the avionic unit;

defining third data for at least one ground control station and loading said data into the station;

defining interfaces;

defining communication channels and their respective properties;

defining sensors, transmitters, switches, and video cameras;

determining operating logics of the collision avoidance function and their implementation in the avionic unit;

determining operating logics of the alarm function and their implementation in the avionic unit;

determining operating logics of the ground control station and loading them into the station;

comparing the position of the aircraft constantly with predefined and stored authorized limits intervening automatically on the autopilot to take the aircraft to its spatial limit through the interfaces when the aircraft deviates from the authorized limits storing the situation of the aircraft onboard in the memory unit and not automatically transmitting to the ground control stations; and

transmitting said information generated onboard to the ground control stations for appropriate evaluation when a second alarm state is activated in cases of alarm.

24. Method according to claim 23 wherein the electronic processing means process receive information and compare it in real time with data referring to predefined flight paths and allowed altitudes or flight levels, and wherein the interfaces receive flight information from onboard systems and send commands to the aircraft's autopilot to take over the control of the aircraft and bring it back to predefined altitudes or flight levels or spatial positions, and wherein sensors obtain data on the situation onboard the aircraft, and wherein the communication means and the connecting interfaces transmit information relating to onboard situation in real time to ground control stations and receive appropriate instructions from the ground control station or from another aircraft when predetermined events occur.